Privacy PolicyYour data, in plain English.

Kivro Solutions (“Kivro”, “we”, “us”, “our”) is a software engineering, product design and technology consulting studio. We operate this website at kivrosolutions.com and we deliver strategy, design and engineering services to organisations around the world.

This Privacy Policy explains how we handle personal data when you visit this website, contact us about a project, engage us as a client, work with us as a partner or supplier, or apply for a role with us. It is written to satisfy the UK GDPR, the EU General Data Protection Regulation (GDPR), the Privacy and Electronic Communications Regulations (UK PECR), the EU ePrivacy rules as implemented locally, the California Consumer Privacy Act as amended (CPRA), and Pakistan’s applicable data protection and privacy law — including the rights available to you under each.

Two important distinctions run through this document. When you browse our site or send us an enquiry, we are the controller of that data — we decide why and how it is processed. When you appoint us to build software that operates on your users’ data, you are the controller and we act as your processor under a signed data processing agreement. Processor engagements are governed by that agreement, not by this policy. We flag this explicitly each time it matters because mixing the two up is the single most common privacy mistake we see in our industry.

Unless we are processing personal data on your behalf under a signed agreement, Kivro Solutions is the data controller. We are based in Faisalabad, Punjab, Pakistan, and we also work with clients and partners in the United Kingdom and the European Economic Area.

Controller and processor roles

The distinction is practical, so it is worth being precise:

• Controller (we are). You browse the site, fill in an enquiry form, apply for a job, or otherwise deal with us directly. We decide what we collect and how long we keep it. This policy applies.
• Processor (you are). You ask us to build a platform, application or integration that processes personal data belonging to your customers, employees or users. You instruct us on what that data is used for, and we act on your documented instructions under a data processing agreement.
• Joint controllers. In a small number of situations — typically a co-branded campaign or a jointly delivered engagement — we determine the purposes of processing together with another party. Where that applies, we agree responsibilities in writing before launch rather than leaving it ambiguous later.

Information you choose to give us

This is the information you type into a form, send in an email, or hand us in a meeting. We only ask for what we need to progress the conversation.

• Enquiry and contact details — your name, work email address, company or organisation, job title, phone or WhatsApp number, preferred language, and your approximate location.
• Project brief information — the problem you are trying to solve, target platforms, integrations, budget range, target timeline, and any other context you choose to include in a brief or discovery call.
• Correspondence and meeting notes — the content of emails, call notes, shared documents and project-management thread comments. We keep these because they are the record of what was agreed.
• Contracting and billing information — the legal name and registered address of your company, purchase order references, tax or VAT registration details, and the bank account you ask us to invoice. We never see or store full payment card numbers; payment is handled by our payment provider.
• Recruitment information — your CV or portfolio, cover letter, work history, references, interview notes, and right-to-work information, if you apply for a role with us.
• Event and webinar registrations — the name and email address you provide when you register for a session, along with your attendance record if the event is hosted on a third-party platform.
• Accessibility and support information — if you ask us to adapt something for you, the details you provide so we can do so.

Information collected automatically

Our web server records limited technical information when a page is requested. This is standard practice for any website that takes a request over the internet, and it is how we keep the service available and detect abuse.

• Your IP address, and an approximate location derived from it at country or city level.
• Browser type and version, operating system, device category, screen resolution and interface language.
• The page you came from, the pages you visited on our site, how long you stayed, and the sequence of pages you viewed.
• Interaction events such as clicks, scroll depth, form validation errors and outbound link clicks.
• Cookie and similar-technology identifiers assigned to your browser.
• Timestamped request logs used for rate limiting, abuse detection and incident investigation.

Information from other sources

• Service providers — hosting, error monitoring, customer relationship management, email delivery and support desk providers share limited technical or content data with us so their tools can function. Each is bound by contract.
• Social platforms — if you apply for a role through or message us on LinkedIn, Instagram, Facebook or WhatsApp, we receive what you choose to share on those platforms. Those platforms also have their own privacy policies, which govern them, not us.
• Publicly available sources — occasional company information such as a registered company name, office address or public professional profile, used to verify a business enquiry or, where you have consented, to send relevant business updates.
• Your employer or referral partner — if a colleague or a referral partner introduces you, they may share your contact details and a short description of the project. We will use it to contact you about that project and nothing else.

Details you should not send us

Email and messaging tools are not secure vaults. Please do not send us passwords, authentication secrets, full payment card details, government identity documents, or medical information. If you have already sent any of these, tell us and we will delete them immediately and confirm that we have done so.

Under the UK and EU GDPR we must have a lawful basis before touching personal data. The table below states, for each purpose, what we rely on. We rely on consent sparingly — mainly for marketing and optional cookies — because consent is the easiest basis to get wrong and the easiest for a customer to withdraw.

How we keep our uses fair

• Purpose limitation. We use data for the purpose we told you about. If a new purpose arises that would be incompatible with the original, we ask you again before proceeding.
• Data minimisation. We collect the narrowest field that will do the job. A country is enough for tax and invoicing; we do not need your full home address.
• Storage limitation. We do not keep data simply because it might be useful later. Retention periods are set out below and are not discretionary.
• Accuracy. We rely on you to keep the information you give us current. Tell us when it changes and we will correct our records.

A cookie is a small file a website asks your browser to store. We use the minimum required to make the site work, and we group everything we use into the categories below so you can see, at a glance, what is actually running.

Where consent is required — for example for non-essential analytics or marketing cookies in the UK, the EEA and comparable jurisdictions — we ask for it before setting anything, and we treat the absence of a choice as “no” rather than “yes”.

How to control cookies

• Every major browser lets you view, block and delete cookies through its settings, and most offer a “block third-party cookies” option. Doing so will not break the core site.
• Where a consent management control is present, you can change your mind at any time; your choice is stored in a strictly necessary cookie so we do not ask you again on every page.
• We honour Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of personal information.
• We do not respond to legacy Do Not Track signals, because we do not conduct cross-context behavioural advertising that the signal is designed to suppress.

We can provide a complete, current inventory of every cookie and storage identifier set by this site, including name, purpose, duration and category, on request. Ask us and we will send it.

We do not sell personal data. Not for money, not for consideration, not in exchange for anything. We do not share personal information for cross-context behavioural advertising as that term is defined by the CPRA. The only people who see your data are the ones who need it in order to provide a service to you or to meet a legal duty.

Service providers acting on our instructions

We use a small number of specialist providers. Each is contractually bound to process data only on our documented instructions, to protect it, and to delete or return it when the engagement ends.

When we disclose without asking first

• With your explicit consent, for example when you ask us to share a case study with a prospective client.
• To vetted subcontractors on our behalf, under a written back-to-back contract. You can request the current list.
• To a successor entity in the event of a merger, reorganisation, financing or sale of all or substantially all of our assets — with notice to you and continued protection under this policy.
• To law-enforcement or regulators where we are legally compelled to do so. We assess requests for legal compulsion and challenge overbroad ones where we reasonably can.
• To protect the rights, safety and integrity of Kivro, our users, the public, or to establish, exercise or defend legal claims.
• Within our group of companies, where the recipient is bound by this policy or an equivalent one.

We are a globally distributed studio. Data collected from a visitor in London or Frankfurt may be processed in Pakistan, the United Kingdom, the EEA or the United States, depending on which of our providers handles it and where their infrastructure sits. We do not treat that as an accident to be tolerated; it is a decision we manage.

Safeguards we rely on

• Adequacy decisions where the destination has been deemed adequate by the UK or EU, such as the United Kingdom for transfers from the EEA.
• UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, for restricted transfers out of the UK.
• EU Standard Contractual Clauses, completed where appropriate, together with a transfer risk assessment.
• Pakistan’s Personal Data Protection Act and any implementing rules, applied alongside the above where the recipient is established in Pakistan.
• Consent, obtained explicitly and separately in cases where no other transfer tool is appropriate.
• Data minimisation and access control, so the volume of data crossing a border is as small as the task allows.

You can request a copy of the safeguards applicable to a transfer affecting your data, and the contact details of the relevant recipient, by emailing us. We will provide it without charge.

No system is perfectly secure, and any provider claiming otherwise is selling something. What we can tell you is what we actually do, the controls we test, and what happens if something goes wrong.

Technical and organisational measures

• Encryption in transit using modern TLS, and encryption at rest for stored data and backups.
• Role-based access control with least-privilege defaults, reviewed on join, on change of role and on exit.
• Multi-factor authentication on all administrative, repository, cloud and email accounts.
• Password hashing with current, salted algorithms. We never store or ask for plain-text passwords.
• Separate environments for development, staging and production, with production credentials unavailable to routine development work.
• Centralised logging and alerting for authentication events, privileged actions and unusual data-access patterns.
• Version-controlled infrastructure with peer review for security-relevant changes, and dependency scanning in the build pipeline.
• Encrypted, tested backups with defined recovery objectives, and periodic restoration testing.
• Security awareness training for all personnel handling client or personal data.
• Vetting of subprocessors and annual review of those still needed.

If a breach occurs

We maintain a documented incident response procedure. Where a personal data breach is likely to result in a risk to people’s rights and freedoms, we notify the relevant supervisory authority within 72 hours of becoming aware, as the law requires. Where the risk is high, we also inform the affected individuals directly, in plain language, with the facts and the action we recommend. We keep a written record of all breaches, including those that do not meet the notification threshold, because that is how we learn.

Keeping data “just in case” is not a policy, it is a liability. We apply the following default periods. Where a contract, a tax obligation or a legal claim requires a longer period, that requirement wins; where none does, we delete.

When a period ends, we delete the data or irreversibly anonymise it so that it can no longer be attributed to a person. In the case of client data held under a processor arrangement, the retention schedule in your data processing agreement applies instead.

Subject to the regime that applies to you, you hold a set of enforceable rights. We have built this section so that you can act on any of them without having to write a legal letter first.

Rights you may have under the UK and EU GDPR

• Access — obtain a copy of the personal data we hold about you, and information about how we use it.
• Rectification — have inaccurate or incomplete data corrected. Often the fastest route is simply to tell us the correct value.
• Erasure — have your data deleted where there is no overriding reason to keep it.
• Restriction — ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — receive your data in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time. Objection to direct marketing is unconditional.
• Withdraw consent — change your mind where we rely on consent, without any effect on the lawfulness of processing already done.
• Complain — lodge a complaint with your supervisory data protection regulator.
• Non-discrimination — we will not treat you worse for exercising a right. We do not charge for the first request, and we do not require you to drop a complaint before we help.

How to make a request

1. 1Email info@kivrosolutions.com with the subject line “Data rights request” and tell us which right you are exercising.
2. 2Tell us enough to locate the relevant records — for example the email address you used, or the company you contacted us on behalf of. We will not disclose data belonging to anyone else.
3. 3We may ask for proportionate verification of your identity where the request could result in someone else’s data being released. We will not ask for more than is necessary.
4. 4We respond without undue delay and in any event within one month. Where a request is complex or numerous, we may extend by up to two further months and will tell you why within the first month.
5. 5We do not charge unless a request is manifestly unfounded or excessive, and we will explain any charge before applying it.

If you are a UK or EU resident

We would always prefer to hear from you directly, because we can usually resolve a concern in a couple of emails. If you are not satisfied with our response, you may complain to your national supervisory authority. In the United Kingdom that is the Information Commissioner’s Office at ico.org.uk. In the EEA, it is the authority in your country of residence, work or the place of the alleged infringement — you can find yours on the European Data Protection Board’s site.

If you are a California resident

The California Consumer Privacy Act as amended by the CPRA gives you the right to know what personal information we collect and how we use and disclose it, the right to request deletion, the right to request correction, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising any of these. To our knowledge we do not sell personal information, we have not shared personal information for cross-context behavioural advertising, and we do not use sensitive personal information for inferring characteristics about you. “Shine the light” requests can be made to info@kivrosolutions.com and we respond within the statutory period.

Other jurisdictions

Residents of other jurisdictions, including Pakistan, Saudi Arabia, the UAE, Canada, Australia and India, may have equivalent rights under their own laws. We apply a single, generous standard across the board rather than a reduced one, so simply write to us. Where you are in Pakistan, you may also raise a concern with the relevant regulatory authority; we will cooperate fully and will provide you with the contact details of the appropriate body on request.

We do not use your personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on you. You will not be denied a service, priced differently, or treated adversely because an algorithm decided so.

We do apply limited profiling, and we are transparent about it. Aggregated usage data helps us identify which pages are genuinely useful and which are not. Security tooling profiles request patterns to detect automated abuse. In every case the profile affects our understanding of the service, not your entitlements. Where profiling does touch an individual decision, a human reviews it and you can request that review.

Every marketing email we send includes a working unsubscribe link, and we honour it immediately and without requiring a reason. We do not buy or scrape contact lists, and we do not add anyone to a marketing list without a lawful basis — usually their own request, or a soft opt-in where an existing client has asked us to follow up about genuinely similar services.

We may contact you over WhatsApp, LinkedIn or by phone where you have asked us to or where you are an existing client and the message concerns work we are already doing together. Where local advertising rules require prior consent for such messages, we obtain it before the first message and keep a record of that consent.

Our services are business services. This website is not directed at children, and we do not knowingly collect personal data from anyone under 18, or under the age of digital consent in your jurisdiction where that is higher. We do not knowingly collect data from children under 13 in the United States without verifiable parental consent, and in practice we simply do not offer anything to that age group.

If you are a parent or guardian and believe a child has provided us personal data, contact us and we will delete it promptly. We do not use children’s data for advertising or profiling, and we never sell it.

Where our site links to another website, or a portfolio piece references a third-party platform, that other party is responsible for its own data practices under its own policy. We are not responsible for the content, security or privacy practices of external sites, and a link is not an endorsement unless we say so explicitly.

We avoid embedding third-party trackers and advertising widgets by default. Where a page includes an embed — a video player, a map, a live chat — the provider may set its own cookies and process data independently of us. We label these clearly so you can choose whether to load them.

We do not currently deploy cross-context behavioural advertising, so a legacy Do Not Track signal would not change anything about what we do. Where we do receive a Global Privacy Control signal, we treat it as a valid and legally recognised request to opt out of the sale or sharing of personal information, and we honour it regardless of your browser settings.

We review this policy at least annually and whenever we make a material change to what we do with data. The “Effective” and “Last updated” dates at the top of this page always reflect the current version. Where a change is material — expanding a category of data we collect, introducing a new category of recipient, or adding a new tracking technology — we will give reasonable notice in advance, by on-site notice and, where we hold your email address, by email, at least 30 days before it takes effect.

Archived versions of previous policies are available on request. Continued use of the site after a change takes effect means the revised policy applies to you from that point on; it is not a fresh contract that you have to sign.

If anything in this policy is unclear, if you want to exercise a right, or if you simply want to know what we hold about you, contact us. You will reach a person who can act on it, not a ticketing system that closes itself in seven days.